Re: [OPSEC] OPSEC Digest, Vol 89, Issue 4

Ray Hunter <v6ops@globis.net> Sat, 16 May 2015 13:55 UTC

Message-ID: <55574C32.2060404@globis.net>
Date: Sat, 16 May 2015 15:54:58 +0200
From: Ray Hunter <v6ops@globis.net>
User-Agent: Postbox 3.0.11 (Macintosh/20140602)
MIME-Version: 1.0
To: opsec@ietf.org
References: <mailman.2436.1431463445.17967.opsec@ietf.org>
In-Reply-To: <mailman.2436.1431463445.17967.opsec@ietf.org>
Content-Type: multipart/alternative; boundary="------------010000080207080409070407"
Archived-At: <http://mailarchive.ietf.org/arch/msg/opsec/kB3kYgUdqXHgZoh7AvPLeSQYs7Q>
Subject: Re: [OPSEC] OPSEC Digest, Vol 89, Issue 4
Precedence: list


> Date:Tue, 12 May 2015 22:43:52  +0200
> From: Gert Doering<gert@space.net>
> To: Jean-Michel Combes<jeanmichel.combes@gmail.com>
> Cc:"opsec@ietf.org"  <opsec@ietf.org>, Ivan Pepelnjak<ip@ipspace.net>
> Subject: Re: [OPSEC] [Opsec] RFC7454: clarification about AS-Path
> 	Filtering
> Message-ID:<20150512204352.GP54385@Space.Net>
> Content-Type: text/plain; charset="us-ascii"
>
> Hi,
>
> On Tue, May 12, 2015 at 07:47:18PM +0200, Jean-Michel Combes wrote:
>> >  The sentence "Network administrators SHOULD NOT advertise prefixes with a
>> >  nonempty AS path unless either they intend to provide transit for these
>> >  prefixes or they are originated these prefixes." would not be simply more
>> >  correct?
>
> Advertising your own prefixes is actually matched by filtering on the
> path ^$ in Cisco regex speak - read: "the empty path".
>
> So, it is a slightly complicated way to formulate the thing, but it is
> correct - a nonempty path means "transit for other ASes", and the empty
> path is "yourself".  On outbound.
>
> Your peer, on inbound, won't see an empty path of course.
>
> Gert Doering
>          -- NetMaster
> -- have you enabled IPv6 on something today...? SpaceNet AG Vorstand: 
> Sebastian v. Bomhard Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. 
> Grundner-Culemann D-80807 Muenchen HRB: 136055 (AG Muenchen) Tel: +49 
> (0)89/32356-444 USt-IdNr.: DE813185279
Unless you're intentionally performing AS prepending on prefixes you are 
originating.

But I guess that exception should be obvious for most people who 
configure up BGP.

Re: [OPSEC] OPSEC Digest, Vol 89, Issue 4 Ray Hunter